tadrik Free store check

Plugin security / SureCart

SureCart vulnerability: is your WooCommerce store affected?

SureCart has 10 serious security holes rated 7 or higher out of 10 that someone can use with no login or with only a customer account. The newest was published on 3 November 2026. Every one is fixed: update to 4.9.6 or newer.

Short answer: your store is affected if it runs SureCart older than 4.9.6. Update to 4.9.6 or newer, on a copy of the store first if you can.

The security holes

Newest first. Each one is published in a public security database and fixed in the version shown.

  1. Account takeover

    Someone could log in as another user, an admin included, without their password.

    Score 8.1 (high)no login neededAffected: older than 4.9.6Fixed in 4.9.6Published 3 November 2026CVE-2026-120574

    Advisory: The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and including, 4.9.5.

  2. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 7.2 (high)no login neededAffected: older than 4.9.6Fixed in 4.9.6Published 30 October 2026CVE-2026-107653

    Advisory: The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter...

  3. Account takeover

    Someone could log in as another user, an admin included, without their password.

    Score 9.8 (critical)no login neededAffected: older than 4.9.6Fixed in 4.9.6Published 22 October 2026CVE-2026-112241

    Advisory: Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.This issue affects SureCart: from n/a through 4.9.5.

  4. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 7.1 (high)no login neededAffected: older than 4.9.6Fixed in 4.9.6Published 20 October 2026CVE-2026-112221

    Advisory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.5.

  5. PHP object injection

    In some setups, someone could make your server run code.

    Score 8.8 (high)needs only a customer accountAffected: older than 4.9.4Fixed in 4.9.4Published 13 October 2026CVE-2026-106599

    Advisory: Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart surecart allows Object Injection.This issue affects SureCart: from n/a through 4.9.3.

  6. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 7.2 (high)no login neededAffected: older than 4.9.5Fixed in 4.9.5Published 13 October 2026CVE-2026-109224

    Advisory: The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter...

  7. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 7.1 (high)no login neededAffected: older than 4.9.4Fixed in 4.9.4Published 13 October 2026CVE-2026-105874

    Advisory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Reflected XSS.This issue affects SureCart: from n/a through 4.9.3.

  8. Account takeover

    Someone could log in as another user, an admin included, without their password.

    Score 8.8 (high)needs only a customer accountAffected: older than 4.6.3Fixed in 4.6.3Published 6 September 2026CVE-2026-18480

    Advisory: The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change...

  9. Account takeover

    Someone could log in as another user, an admin included, without their password.

    Score 8.1 (high)no login neededAffected: older than 4.3.0Fixed in 4.3.0Published 26 June 2026CVE-2026-7655

    Advisory: The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3.

  10. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 7.1 (high)no login neededAffected: older than 4.3.3Fixed in 4.3.3Published 26 June 2026CVE-2026-57314

    Advisory: Unauthenticated Cross Site Scripting (XSS) in SureCart <= 4.3.2 versions.

How to check your version

  1. Log in to WordPress and open Plugins > Installed Plugins.
  2. Find SureCart. The version number is under its name. If it is lower than 4.9.6, your store is affected.
  3. No login to hand? Open https://yourstore.com/wp-content/plugins/surecart/readme.txt in a browser, with your own address in place of yourstore.com, and read the Stable tag line. Some hosts block this file; then use step 1.

How to fix it

  1. Make a backup, or better, a staging copy of the store (most hosts have a one-click staging button).
  2. On the copy, update SureCart to 4.9.6 or newer: Dashboard > Updates, or Update now on the Plugins page.
  3. If no update shows, it may be a paid version whose licence has run out: download the new version from the seller's site and upload it.
  4. Place a test order on the copy: add to cart, check out, pay with a test method. Check the pages that use SureCart.
  5. If everything works, make the same update on the live store and place one more test order.
  6. If you no longer use SureCart, delete it instead of leaving it deactivated.

Not sure, or no time?

Get a free check of your store: we look at its public pages for plugins with known holes, and reply within one working day. Or we fix it for you: we update your store on a copy, place a test order, and only then change the live store, for a fixed £99 / $119.

Free store check Fix it for me on a copy

Questions

Which SureCart version fixes it?
Version 4.9.6 or newer fixes all 10 issues on this page.
How do I know if my store is affected?
Your store is affected if it runs SureCart older than 4.9.6. In WordPress, open Plugins and read the version under SureCart. Without logging in, open yourstore.com/wp-content/plugins/surecart/readme.txt and read the Stable tag line.
I don't use SureCart any more. Is a deactivated copy safe?
Deactivating it lowers the risk but leaves the old code on your server. If you don't use it, delete it; if you do, update it.
Can someone fix it for me?
Yes. We update the store on a copy first, place a test order, and only then make the same change on the live store, for a fixed price.

Vulnerability data: WPVulnerability (wpvulnerability.net, CC0), which links each entry to its CVE or advisory. Store numbers: Tadrik's own checks of public pages, aggregates only. Page updated 5 November 2026.